To add to what Jono said, the permission system is generalized to entire resources (e.g. /clients/). If you give staff access to clients, they can see all clients. There is currently no mechanism to limit staff to access only certain clients based on some criteria. However, if you create a plugin, you can setup plugin events that listen for an event like the AppController.preAction event that is called when someone views a page, and your plugin can perform logic to determine whether this is a staff user and whether they are viewing an appropriate client they have access to or not, and redirect them elsewhere if necessary.